Vulnerability of the DOM component: The Core and HTML components of the Firefox web browser and Thunderbird email client, allowing attackers to trigger a service failure.

Vulnerability of the DOM component: The Core and HTML components of the Firefox web browser and Thunderbird email client are vulnerable due to improper restrictions on the visible layers of the user interface. Exploiting this vulnerability can allow a remote attacker to cause service interruption...

Linux Distros Unpatched Vulnerability : CVE-2026-59090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a...

CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

EUVD-2026-54685

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-48169

PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key lookups without checking workspace ownership, so any...

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

AZL-95490 CVE-2026-65819 affecting package telegraf for versions less than 1.31.0-31

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

JLSEC-2026-1203 A vulnerability exists where a connection requiring TLS incorrectly reuses an existing...

A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool. If an initial transfer is made in clear-text via IMAP, SMTP, or POP3, a subsequent request to that same host bypasses the TLS requirement and instead transm...

JLSEC-2026-1202 When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a...

When a user invokes curl using a schemeless URL combined with --proto-default sftp or scp, a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like...

JLSEC-2026-1214 The curl logic that works with SASL authentication could end up cleaning up the GSASL context ...

The curl logic that works with SASL authentication could end up cleaning up the GSASL context twice without clearing the pointer in between, making it free the same pointer twice...

CVE-2026-15970 L7 intention authorization bypass via custom public listener

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

CVE-2026-15970 L7 intention authorization bypass via custom public listener

Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This...

CVE-2026-65819

CVE-2026-65819 affects gopacket before version 1.7.0, where multiple layer decoders may read attacker-controlled lengths, counts, or offsets before validating buffers. A crafted packet decoded via DecodingLayerParser or DecodeFromBytes can trigger an unrecovered panic, enabling unauthenticated re...

CVE-2026-65819 gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-65819 gopacket: Multiple layer decoders panic on crafted packets (out-of-bounds/underflow) enabling unauthenticated remote DoS via DecodingLayerParser

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

CVE-2026-65819

gopacket provides packet processing capabilities for Go. Through version 1.7.0, multiple layer decoders use attacker-controlled lengths, counts, or offsets before validating them against packet buffers, allowing a crafted packet decoded through DecodingLayerParser or DecodeFromBytes to trigger an...

TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain

...

TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication

...

EUVD-2026-54396

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...

CVE-2026-49006

CVE-2026-49006 affects ZTE device firmware. The issue arises from accessing unencrypted information in the firmware, allowing an attacker with adjacent access (AV:A) and high access complexity (AC:H) to obtain credentials related to TLS transmission, with no privileges required and no user intera...